DependencyTrack / DependencyTrack/dependency-track

Enable OSV vulnerability source per default

Open
#5,343 11 comments 0 reactions 0 assignees View on GitHub
enhancement p2 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

We previously enabled the OSS Index analyzer per default, since it allowed for unauthenticated usage.

The other vulnerability source that is enabled per default is the NVD. It however does not provide PURL matching data and is thus not of great help during vulnerability analysis.

We need another, PURL-based alternative that can be enabled per default.

### Proposed Behavior

Enable the OSV integration per default.

It provides PURL matching data, does not require authentication, and has broad ecosystem coverage.

Consider limiting the default to a small selection of popular ecosystems.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.